Apple is currently holding $181 billion overseas - <AUTHOR> https://theintercept.com/2016/08/16/ceo-tim-cook-decides-apple-doesnt-have-to-pay-corporate-tax-rate-because-its-unfair/ <comment><USER2> > Wouldn't it be great if you could refuse to pay your taxes until you decided > your tax rate was "fair"?

If by "refuse to pay your taxes" you mean "refuse to pay tax on the portion of your income that you have the legal ability to not pay tax on", then yes, that is pretty great. I and many others do that on a regular basis.

If the tax department wants a company to pay more tax, it has two options: 1. legally require them to, 2. convince them that there is some other reason to. A great way to achieve option 2 is to threaten them with option 1.

Right now there's an extended negotiation happening between Apple (and friends) and the government, where both parties sure would like to avoid a whole bunch of new onerous legislation, and it would appear Tim Cook is describing the situation under which Apple would be willing to come to terms.

If there's no deal I'm sure the resulting new laws will be a huge nightmare for everyone involved, so both parties have an incentive to negotiate pretty hard without actually backing away from the table. It's an interesting look at what happens when you're a big enough company to negotiate with the government.

Not sure what all the bleating in this article is about though. You pay the tax you have to pay and no more. Has the author ever filed a tax return? Does he pay more than his required amount of tax out of a sense of patriotic duty? If not, I find this framing pretty deceptive. Nobody's giving gifts to the tax department.

</comment><comment><USER3> What people understand from that article:

\- Apple makes money in the US and because of various tax loopholes, does not pay corporate taxes for those revenues

What happens in reality:

\- Apple makes money in many different countries and pays corporate taxes in each of them (including the US), but if AFTER paying taxes (for example in an European country) they want to bring back some of that already taxed money to the US, they have to pay an additional ~40% in taxes.

Think of it this way, you as an employee go to work for one year in a European country. There you pay all your taxes and after that year you want to return to the US, but now the US decides you need to also pay income taxes in the US for your salary in Belgium.

<comment><USER4> > if AFTER paying taxes (for example in an European country) they want to > bring back some of that already taxed money to the US, they have to pay an > additional ~40% in taxes.

Except this isn't what is happening. In Europe at least they practice the double Irish [0]. So effectively the stash we're talking about haven't been taxed yet.

[0] [https://en.wikipedia.org/wiki/Double_Irish_arrangement](https://en.wikipedia.org/wiki/Double_Irish_arrangement)

</comment></comment><comment><USER5> This article references an interview found in the Washington Post... [https://www.washingtonpost.com/classic-apps/stepping-out- of-...](https://www.washingtonpost.com/classic-apps/stepping-out-of-steve- jobss-shadow-tim-cook-champions-the-promise-of- apple/2016/08/12/fadb6c26-59cd-11e6-831d-0324760ca856_story.html?wpisrc=nl_draw2&wpmm=1)

In that interview Mr. Cook says "We've said at 40 percent, we're not going to bring it back until there's a fair rate."

I wonder what he considers a fair rate?

<comment><USER6> It should be close to zero, why are we forcing Apple to pay taxes twice? Let them bring the money back and they will put it to much better use than any government organization. They could hire huge numbers of people and contribute to a massive trade surplus.

<comment><USER7> _why are we forcing Apple to pay taxes twice?_

We're not. The "Double Irish", "Dutch Sandwich" and other arrangements are about funneling the maximum possible amount of revenue through subsidiaries which can do tax-free or tax-deductible payments and transfers to each other, until finally the money ends up on the books of a company whose tax residency is Bermuda or the Cayman Islands, both of which have no corporate income tax.

As of a few years ago, it was reported that Google had gotten so good at this that 99.8% of their revenue outside the US was showing up in a subsidiary with Bermuda tax residency.

So that money wouldn't be "taxed twice" if brought into the US -- the whole point of the arrangement is that _it hasn 't even been taxed once yet_.

<comment><USER6> Countries don't need to have a corporate tax, and if they do not have a corporate tax it doesn't mean the US government should get a piece of the pie because no one else decided to take it.

Just like a Comcast monopoly in a small rural town the US government without competition would continue to soak up more money and spend it on increasingly useless things.

<comment><USER7> Don't look now, but you just moved the goalposts.

<comment><USER6> Governments are averse to competition, bureaucrats need to realize they cannot bully companies into paying ever increasing taxes within a global economy. The goalposts moved a long time ago, I did not move them.

<comment><USER7> Well, the original complaint I responded to was "they shouldn't be taxed twice on the same money", and I pointed out they're not being taxed twice on the same money.

Meanwhile, if Apple wants to bring this money into the US, well, they can do what the US tells them to do when it comes to taxes. Apple has benefited enormously from services and infrastructure paid for by everyone else's taxes, and shouldn't get to leech off that without having to play by the same rules (and I say this as someone who pays a higher percentage of my own income in tax than Apple would even if it repatriated all its profits).

<comment><USER6> I did not find that part of your argument to be substantial to the core of my point, they followed whatever tax regulations they were subject to abroad and if there are loopholes then those countries can close them if they so desire.

Overseas profits will end up paying for corporate infrastructure and jobs elsewhere, penalizing global activities by taxing profits which do not occur in the US is not a very forward thinking strategy for the US Government and it's why we will continue to get killed in trade with deficits until it obliterates our economy.

<comment><USER7> _Overseas profits will end up paying for corporate infrastructure and jobs elsewhere_

If those profits are never taxed, they won't. Of course, to avoid them being taxed you have to leave them sitting in accounts in Bermuda and the Caymans where that money can't be productive for the company either.

 _by taxing profits which do not occur in the US_

The US isn't asking to tax their overseas profits. If you can't make your argument without openly lying about what's going on, I don't know how you can expect to be taken seriously.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> These are profits which are not being made within the US I am guessing? This is something that seems to be glossed over but it's a really important distinction to be made.

Apple's actions seem pretty reasonable, if you worked and lived abroad as a US citizen would you be very happy if Uncle Sam reached into your back pocket for a cut of your income after paying into the local tax system? This is essentially what they are asking of Apple.. the US government should get a cut of transactions which never took place in the US.

<comment><USER8> Any american citizen that does not live in the US still has to pay taxes if they have to pay I don't see why apple or other corporations can or should get out of paying it.

<comment><USER6> I doubt any sane person keeps their US citizenship for very long if they are living and working abroad. Apple should move out of the US in my opinion if they are going to get taxed on transactions outside of the US.

<comment><USER9> I'm of the opinion patriotism and nationalism are not sane, but most people are pretty proud to have those traits:

[http://www.bbc.com/news/35383435](http://www.bbc.com/news/35383435)

</comment></comment></comment></comment><comment><USER10> I'm not a fan of Apple or its business practices but that's exactly what Google, Microsoft and all the other bigger IT (and other) companies are doing too. No news here.

</comment><comment><USER11> Offer them a partial amnesty: repatriate the funds at a 20% tax rate or so.

The goverment wins because 20% of $181bn is way more than 40% of nothing, and Apple wins because they get to use the money within the US.

Partial amnesties for repratriation have been been done before, most recently in Greece as far as I know.

<comment><USER12> Please look up what 'amnesty' means. Apple isn't doing anything wrong or illegal by keeping its cash outside of the US. Also note the the US tax code is the only one (in advanced countries) to try to tax earnings made outside of its jurisdiction (e.g. for earnings made in Japan, and already taxed locally there).

Cook is not saying Apple shouldn't pay taxes, he simply says the IRS has no business taking 40% of earnings not made in the US. If you were an expat you would strongly agree with him.

<comment><USER11> 'Amnesty' was indeed a poor example. Call it a special repatriation tax rebate, or whatever.

Otherwise, you're reading far too much into my comment. With the current tax rules as given, I merely suggested a possible compromise.

At no point did I argue for/against the rules, and at no point did I agree/disagree with what Cook is saying.</comment></comment></comment>


D3js DOM inspector - <AUTHOR> http://www.youtube.com/watch?v=XXhS2KwPXGo

<comment><AUTHOR> Here's the technique I use for attaching to d3 lib:

[https://gist.github.com/dnprock/7128757](https://gist.github.com/dnprock/7128757)</comment>


Discovering new medicines is as much about culture as science - <AUTHOR> http://www.thenational.ae/thenationalconversation/comment/discovering-new-medicines-is-as-much-about-culture-as-science <comment><USER2> Drug discovery is perhaps the hardest intellectual problem. The human body is extraordinarily complicated --- perhaps more complicated than it needs to be to function, but that is another discussion. And yet great minds have found ways to fix it at a molecular level when it fails. I am in awe of the scientists who have invented the cures that we take for granted today. And yet so much remains to be done. Today, only a handful of treatments exist for the countless ailments that strike us down dead.

</comment><comment><USER3> Drug discovery in the academia works very differently from drug discovery in the pharmaceutical industry (the companies that actually profit from selling drugs).

Have you ever wondered how people find out the exact combination of complicated molecules (tri-ethyl bi-methyl chloro fluoro benzo whatever) that help treat a specific disease? That's like finding the proverbial needle in a gigantic haystack...

Unless you have the money and equipment to perform a brute-force attack.

My professor once described to me one of the methods that drug companies use to come up with new drugs. I forgot a lot of the details, but the basic idea is that they keep an eye on medical journals for newly discovered receptors (the part of a cell that molecules can bind to), and then throw every plausible combination of molecules at that receptor until they find one that sticks. If the one that sticks the best happens to be patented by someone else, you just keep throwing similar molecules until you find the one that sticks the second best.

Large pharmaceutical companies can pull this off because they keep a huge repertoire of all sorts of molecules that are utterly useless at the moment but might stick to some receptor that has yet to be discovered. It really is a kind of brute-force attack, aided by the biochemical equivalent of a rainbow table. Apparently, this method works.</comment>


Show HN: Income Reports Dashboard for Buffer, WPCurve, Baremetrics, Groove) - <AUTHOR> http://www.incomereports.co/

<comment><USER2> Nice idea. You can create a customizable plugin with nice graphs so bloggers can put it inside their income reports.

</comment><comment><AUTHOR> Hey guys,

Let me know what do you think. Currently there are 9 websites listed/tracked...I plan to add more, any suggestions?

Thanks</comment>


Security on an untrusted client - locking down a javascript library - <AUTHOR> http://blog.filepicker.io/post/34711581338/security-on-an-untrusted-client-locking-down-a <comment><USER2> For anyone that kept seeing "HMAC" and thought "What in the hell..." I wrote an article (stream of thought in story format) describing how you might try and secure an API call, how AWS does it and eventually how 2-legged OAuth can be utilized to do it:

[http://www.thebuzzmedia.com/designing-a-secure-rest-api- with...](http://www.thebuzzmedia.com/designing-a-secure-rest-api-without- oauth-authentication/)

NOTE: This is written from the perspective of "My god, what does this all mean?"

NOTE #2: You can do away with almost ALL of this complexity if you just force everyone onto SSL connections, but then you have to be ok with the increased latency introduced connection-(re)negotiation; just depends on what your API needs to do.

NOTE #3: I think the title of this article is misleading... there is no security on an untrusted client using HMAC -- if your client knows your secret AND they are untrusted, then you have problems.

I wasn't clear from the article how the JS library running client side is adding the secret to the digest before sending the request to the server to verify and process.

For those AWS folks out there, that is what your AWS secret is used for -- your request, e.g.: /ec2/launch?cust=bdillon&size=xl&quant=2&sig=akjDjlasdmnDASkljasd

to sign the entire request, so when AWS receives the request, the first thing it does is attempt to re-create the exact same signature using the secret it has on file for "bdillon" (or whatever customer-identifying info was sent)

This requires both the caller and server to know the secret and I am not clear on how filepicker is solving this from this article... very broad strokes, no specific impl details from what I saw.

<comment><USER3> Yup, didn't want to get into the weeds with the specifics, but we use the same procedure as AWS, where we use the shared secret to recreate the signature provided and then match the two (as well as verifying the method performed is allowed in the policy, and the expiry time is correct). Happy to go into more details if you'd like, also available at <https://developers.filepicker.io/docs/security/>

In reference to the js library as client-side, the key thing we were looking to solve was how to implement a token-based scheme where even if someone had access to the running javascript via xss or just malicious console behavior, the amount of damage they could do would be limited. Balancing that with the simplicity requirements to not use handshakes and allow for embedding urls within <img> tags resulted in the scheme we implemented

</comment></comment><comment><USER4> Critical feedback: This article doesn't seem to be grammar-checked and there's at least one paragraph that is incomplete. The entire thing is difficult to read or understand even for someone with crypto knowledge. I recommend getting future articles peer-reviewed by a layman.

<comment><AUTHOR> Thanks for the feedback folks. Did one more rev and clean it up. Thanks for the suggestion.

<comment><USER5> There are also some very important facets to Information security that you are missing. You describe security as being "based on knowing, doing, or owning something that no one else can". But this is not quite right. You are speaking to only one aspect of security - confidentiality. There is also integrity and availability. Additionally, you are only speaking to the authentication aspect of confidentiality. Your "knowing, doing, or owning" could be more succinctly described as authorization based off of "something you know, something you have, or something you are" which are the 3 main ways that someone could be identified as you they claim to be. Your signature example would generally fall under something you are - but an argument could be made for it being something you know as well.

EDIT:

You also described Public key cryptography as having "2 different keys. One allows for encryption and the other for decryption. In this case, the decryption key is public so everyone can decrypt." This misses the mark a little bit. The public key could be used to encrypt as well, so that only the holder of the private key can read the information. Using the private key to encrypt is generally used in digital signatures so that the recipient can verify that the sender is who they claim to be. This scenario doesn't attempt to keep the data secret, because anyone with access to the public key can decrypt the data.

<comment><USER6> Yeah. I had hoped to scope the conversation down to authentication quickly, because, yes, security means a lot of things. I clearly didn't do that well.

You distinguish between "knowing, doing, or owning" and "something you know, something you have, or something you are"? I guess there might be a slight difference between doing and something you are, but I'm not sure I see the difference?

re. Public Key Crypto. Yes. Using the public key to decrypt and the private key to encrypt is how to use Public Key for author verification and you can reverse it for encryption. One validates the author and the other protects the data.

You are right to say that a better way of saying the sentence would be: "in the case of digital signatures, the public key is used to decrypt thus everyone can decrypt."

Thanks for helping me with this. Will have to be more more clear next time I write something.

<comment><USER5> The something you are (which generally doesn't apply to web-based authentication) are biometrics. So something you are - the pattern of blood vessels in your retina - is something very different from something you "do". The fact that you have "muscle memory" that allows you to sign your name a certain way would again be "something you are". I can't pass that on to someone else - only I can do it.

</comment></comment></comment></comment></comment><comment><USER7> Cool article,

I think as a first step the approach makes sense. I'd propose security is broader than secrets--I think one frame is Authentication, Authorization and Audit (sometimes called the "Gold Standard", because of the repeated "AU" prefixes. Haha, CS meets chemistry humor.).

Anyway... In my mind, Authentication is about secrets, but that can fail. So you use Authorization, so when bad people get access you limit what's compromised. When those two fail, you at least have Audit to either catch the bad actor when they start making trouble, or at worst you can figure out how to stop breaches in future.

And these can mix and match. My two cents.

Thoughts?

<comment><USER3> I like the breakdown between the three. The first two make sense from an API standpoint, hence why we have policies that can specify the range of what a bad actor has access to. We do auditing on our side to keep tabs on anything that seems out of place

</comment></comment><comment><USER8> TLDR; we use hmac signed requests with expiration a la AWS

</comment><comment><USER9> " _being able to encrypt a message is proof that they are who they say they are_ "

Not true. All that that proves is that whoever is on the other end knows the secret.

In that sense the title (" _Security on an untrusted client_ ") is misleading. The only way anyone's going to secure an untrusted client to a point where the system gains my trust is by using:

\- A one-time password [1] to mitgate MITM, key loggers and screen grabbers.

\- Identity federation ( _not_ OpenId or OAuth) that means I can use credentials other than the credentials I use from a trusted client.

\- An application firewall [2] that redacts HTML on the fly so that the disclosure impact of a single GET request is reduced.

\- Ideally (although this is taking things to a whole new level of paranoia) a data diode [3] that protects my server.

 _[Edit]_ The use case will obviously drive out the requirements, and the shopping list above is for a basic web application that only goes as far as form data. If you're looking to work with files you'd have to write up some code that ensures files don't contain nasties. While AV will go some way to doing that, the only way to _really_ get around that is through conversion. I.e. .DOCX is converted to .PDF, .PNG to .JPG, and so forth. Yes, that limits the file types you can deal with, but if you're this far down your requirements aren't exactly main stream.

[1] RSA SecureId (<http://en.wikipedia.org/wiki/RSA_SecurID)or> Chip & PIN challenge/response (<https://en.wikipedia.org/wiki/Chip_Authentication_Program>)

[2] Eg. F5 Big-Ip app security manager ([http://www.f5.com/products/big- ip/big-ip-application-securit...](http://www.f5.com/products/big-ip/big-ip- application-security-manager/overview/)) or Microsoft's Unified Access Gateway ([http://www.microsoft.com/en-us/server- cloud/forefront/unifie...](http://www.microsoft.com/en-us/server- cloud/forefront/unified-access-gateway.aspx)).

[3] Tenix is a high-end solution used by governments. The old Whale Commuications Intelligent Application Gateway used to be a cheap but very effective alternative (<http://en.wikipedia.org/wiki/Unidirectional_network>).

<comment><USER6> Correct. I was not careful enough with all the steps of my logic here.

Being able to encrypt the message proves that the party knows the secret, which if they are the only one who knows it, proves that they are who they say they are.

Indeed, the part about "which if they are the only one who knows it" is important. If you can't trust that, then security starts to break down.

You can sidestep it by instead trusting that they own a device that no one else has, like an one time password. Now, the statement gets a bit longer:

Being able to encrypt the message => the party knows the secret => (If you ask for multiple one, you can beter trust that)=> they have the otp => they are the only one who has it => they are who they say they are.

<comment><USER9> You can _never_ trust a client you don't have _absolute_ control of. Unless you have such control, you can only assume the client is compromised.

I understand that your scenario calls for trust where none is warranted†. That's risk. And your mitigation is to be clear how you handle a compromise (likelyhood).

† As does probably 99.9% of sites on the Internet.

</comment></comment></comment><comment><USER10> "being able to encrypt a message is proof that they are who they say they are"

This is not exactly right. Encryption ensures people cannot eavesdrop on a message but it does not ensure you can verify the sender. You need authentication instead, which is what HMAC does in this case.

<comment><USER3> In general that's true, but specifically referring to public-key encryption only the holder of the private key will be able to create an encrypted message, so it serves as authentication

<comment><USER11> But what if an attacker intercepts this encrypted message and replays it?

<comment><USER2> You can either use a timestamp (that is included in the HMAC calculation to ensure it isn't changed) to allow a replay-window (this is what AWS does) or you can utilize a NONCE value retrieved from the server before hand and recorded as "played" once it is used so no other requests can ever be sent using that nonce.

<comment><USER12> Using a NONCE has some advantages and some disadvantages. There's no need to retrieve the nonce from the server, the client can generate any random value and include it in the signature. However, one of the beautiful properties of HMACs is that the server you're talking to does not need any stored information other than the shared secret to authenticate the request. That makes HMAC-Authentication feasible over a cluster of servers that share no storage if the secret is fixed. Using a NONCE requires that the servers share a storage that updates pretty much immediately, so they all need access to the same datastore that must have practically no replication delay. Otherwise an attacker could still replay the request, just against a different server.

<comment><USER2> _Excellent_ callouts about the NONCE, thanks for adding them! (great points about how this impacts your backend)

</comment></comment></comment></comment></comment></comment><comment><USER13> "Security breaks when humans are involved"

Pretty much sums up life. It's gotten to the point that zero-day exploits scare me less then users writing passwords down on sticky notes, clicking on random links, or letting random people in the building.

<comment><AUTHOR> Since our customers are developers of web and mobile applications we are obviously focused on ensuring that there are no zero-day exploits.

But yes you are right, we have to ensure that we factor in the human angle when designing the solution.</comment></comment>


Monzo Startup Failed – Better Than Your Old Bank Ever Could - <AUTHOR> http://www.thememo.com/2017/03/06/monzo-curve-starling-just-failed-way-better-than-your-bank-ever-could/ <comment><USER2> "They totally failed at their ONE JOB but they sent me a notice that they were failing at it!"

Less shitty != better.</comment>


What Happens When a Drone Hits an Airplane Wing? [video] - <AUTHOR> https://www.youtube.com/watch?v=QH0V7kp-xg0 <comment><USER2> The sheer amount of airplanes in the sky at anytime is incredible. Also designated no fly zones can change and users may be unaware. So to avoid this issue I think we need to do more than just depend on users knowing where they can fly and not.

Drone collides with helicopter in a temporary flight restrictions (TFR) zone: [https://arstechnica.com/tech-policy/2017/12/drone- collides-w...](https://arstechnica.com/tech-policy/2017/12/drone-collides- with-us-army-helicopter-puts-1-5-dent-in-rotor/)

Map of all airplanes currently flying: [https://www.flightradar24.com/40.21,-88.24/6](https://www.flightradar24.com/40.21,-88.24/6)

<comment><USER3> That's really an ADS-B map, which is not actually all planes flying, at least not yet. It's especially sparse for small private planes, which are probably the most likely to find themselves tangling with a drone.

<comment><USER4> Prediction: There will never be a time when all air traffic is ADS-B out equipped. It's certainly not a current mandate, and is only mandated for aircraft desiring access to some select airspace after Jan 1, 2020. I will equip, because I own a hangar inside the mode C veil of Boston, but if I were 6 miles farther out, I may very well choose to avoid class B/C airports and not equip. Lots and lots of traffic will certainly make that choice.

</comment></comment></comment><comment><USER5> I enjoyed that the expert's recommendation was not "regulation", but to change drone design so they more easily break apart on impact. More likely to be implemented and does not need enforcement on the consumer level.

<comment><USER6> I would also support drone manufacturers self regulating via GPS deadzones in designated no fly areas.

Nearly all drones of a meaningful size are GPS enabled and could be disabled in range of a no fly zone. Yes it could be spoofed, yes it would require some effort from manufactures, but self inflicted regulation as an industry here could pay dividends if the alternative is ham fisted regulation following a drone/airplane catastrophe.

<comment><USER7> That's exactly what all major drones do. DJI has a market share of about 75% [1] and you cannot take off any of their success in a restricted flight zone. Flight zone updates are also mandatory and forced to the users. Same for Yuneec, which has another 5% market share.

1\. [http://thedronegirl.com/2018/09/18/dji-market- share/](http://thedronegirl.com/2018/09/18/dji-market-share/)

<comment><USER6> Ah interesting, I didn't know!

</comment></comment></comment></comment><comment><USER8> It made a hole and caused internal damage. But would not have taken down the plane.

Recommendation to make drones "frangible", so they break on impact and do not penetrate into the wing.

In comparison a bird crushed the wing surface but did not cause internal damage.

<comment><USER9> That was enough to take down a plane easily. Wings don't just sit there on the ground like in the video, they support the fuselage of the plane against serious aerodynamic forces.

They are under load, it's like taking out a bunch of columns at the ground floor of a building. Not to mention that wings are full of fuel, as well as the cables or hydraulic lines connected to the control surfaces.

<comment><USER10> The engineer that conducted the test concluded that the plane would have been able to survive the impact. However, he said that if the test were conducted on a faster aircraft like a business jet, the results could be worse.

<comment><USER11> Realizing I should go watch the video, did he say at what height it would be recoverable?

For example, there's been at least one high-profile plane crash in the past (Lauda Flight 004) where a thrust reverser (diverts the jet output forward instead of backwards, used to slow you down quick during landing) deployed mid-flight. That should have been recoverable, but turns out Boeing only projected outcome at low speeds and altitudes. The outcome at cruising speeds/altitudes turned out to be far different and the plane went down.

While cruise wouldn't be an issue (don't think they get up that high!) I'd expect the outcome of a drone hitting a flight control surface might vary between takeoff, landing, and lowish-altitude holding.

</comment></comment></comment></comment><comment><USER12> I think 230mph is unrealistic for such tests. A quick google search shows something between 70mph - 100mph on approach [1]. I doubt drones are found at altitudes of aircraft at cruising speed.

I'm not saying that this isn't a concern but can somebody with actual aviation knowledge (I have none) chime in and explain the 230mph figure?

1: [http://www.mooneyland.com/how-to-land-a-mooney- properly/](http://www.mooneyland.com/how-to-land-a-mooney-properly/)

<comment><USER13> Landing speed for a loaded 737 can be up to 203 mph [0]. Among general aviation, a Gulfstream 450 landing speed can be up to 186 mph at full weight and high altitude. The drone itself can have some speed opposite to the airplane. 230 mph is only a little conservative.

[0] [http://www.b737.org.uk/vspeeds.htm](http://www.b737.org.uk/vspeeds.htm) Note that numbers are in knots.

[1] [http://www.code7700.com/g450_vref.htm](http://www.code7700.com/g450_vref.htm)

<comment><USER12> But surely a 737 wing is completely different to the one tested here?

I'd be very interested to see a 737 wing being tested like this.

<comment><USER14> Completely different? No. Still mostly aluminum sheets riveted to spars with a big ol' gas tank in them. Biggest difference is the control cables would be mostly replaced with hydrolic lines.

</comment></comment></comment></comment><comment><USER15> My brother actually hit a deer on takeoff a few years ago in Charlotte. It was all over the news that day. It did not do as much damage as this drone did. Mostly just dented in the face of the wing which caused fuel to leak out. It was a little closer to the fuselage. That prompted an emergency landing.

<comment><USER16> How does a deer hit the wing? Aren't they rather high? A small plane that's much slower on takeoff/landing than a commercial airliner?

</comment></comment><comment><USER17> This is not all that much more than the damage done by a Canadian goose. I guess makes sense. The drone has to fly so it can't be built like a tank.

</comment><comment><USER18> I'm just glad they used gelatin to simulate a bird. As soon as I heard the guy say he wanted to compare the impact of a drone vs the impact of a bird, I was mentally gasping. XD

I wonder if the results would have been different if they moulded the gelatin into a bird shape (it's moulded as a cylinder in the video, if I'm not mistaken) because then the pressure would have been different. Of course it would probably have been harder to fire from the air pressure cannon.

The block of gelatin also didn't seem to have any hard bits embedded inside. Real birds have bones. While small birds' bones aren't particularly tough, I'm pretty sure the beaks of raptors and some nut-eating birds are tough stuff.

<comment><USER19> Initially plane parts (engines, wings, cockpits) were tested against dead birds but nowadays we have so many live strikes every year that in practice we know what the proxy based on gelatin is for a variety of birds.

Gelatin is harder than flesh but softer than bone and the overall effect is that on average it has the same effect as birds because it is more like an average representation. While parts of birds are relatively tough they aren't in sufficient volume or weight to penetrate any more.

That isn't to say a bird strike isn't pretty dangerous because they can be. Jet cockpits get severely damaged by them as do engines and you can see in the video the effect on a wing.

</comment></comment><comment><USER20> I guess it would depend on if it is this sort of drone:

[https://defensesystems.com/articles/2017/05/02/~/media/GIG/D...](https://defensesystems.com/articles/2017/05/02/~/media/GIG/Defense%20Systems/22mq25aboardaunnavyaircraftcarrier%201.jpg)

or this sort

[https://api.ning.com/files/LxgTrYw8IckDE2ljSVm61iv7MVev4tELr...](https://api.ning.com/files/LxgTrYw8IckDE2ljSVm61iv7MVev4tELr4SQs5fDfPCCGgJEr8F6wV9IgLRaqzvX8Yr8UMSmcYPmgNHxSTWad*1y1neY7WEV/DSC_8004.JPG)

</comment><comment><USER21> It's similar to the question asked here before: "Can a dog kill a man with a cane?". I personally accepted the answer:"Depends on the dog, depends on the man, and depends on the cane".

<comment><USER22> "How is the dog holding the cane?"

</comment></comment><comment><USER23> I'm concerned that the test uses a static wing. If you drop a fishing float directly in front of an obstacle in a river, it will be moved with the water around the obstacle, not hitting it.

Air is a lot less dense than water, but my instinct is that unless the drone hit a very narrow sweet spot it would simply be swept around the wing. And even in that sweet spot, there will be a buffer of compressed air that would substantially slow the impact.

Could someone with more knowledge of fluid dynamics comment on the applicability of static tests like this to actual aircraft damage?

<comment><USER24> Does a baseball move out of the way of the swinging bat? There might be some small effect, but it's not the dominant one. In this scenario the wing is just a slightly bigger bat, and the drone is a slightly bigger ball. It would of course take a very (un)lucky strike to collide dead on like this, but not that unreasonable. I do hope they test indirect strikes too though.

<comment><USER25> I think you're probably right, but note that even for a powerful hitter, bat speed is ~80 mph. This is significantly less than 238 mph used in the video as a typical airplane speed.

</comment></comment></comment><comment><USER26> A year ago I saw someone flying a drone from the top of the Shard building in London. The person was promptly told to land his drone immediately by the security. However the scary thing for me is that the smaller business planes and commercial plane that fly into London city go really close to the Shard on their approach.

So definitely a collision is now a real risk

</comment><comment><USER27> Interesting experiment. Looks like a lot of fun to use that air cannon to blast things at things.

That aircraft doesn't have any de-icing equipment so it is basically just sheet metal where it hit. I'd be curious to see what would happen if it ran into a wing with than just a thin skin.

</comment><comment><USER28> I don't know that much about air dynamics. How likely is it that a drone would strike exactly on the leading edge of a wing, as opposed to passing just over or just under the wing?

<comment><USER29> Also (along the lines of air dynamics) I am wondering about whether an airplane has a force in the direction it is traveling in and if that force does push anything small out of the way.

As a small example if I have a pot in my hand and I move it in the direction of a tissue the tissue will move. So we have a very large airplane wing moving in the direction of a much smaller drone and the test does not simulate that at all.

<comment><USER30> Two things:

1\. Airplane wings are designed _not_ to "push" forward on the air in front of them. That's drag and airplanes are designed to minimize it.

2\. What little air _is_ pushed forward is only going to be affected by the oncoming wing a few inches in front of the wing, and at 230 mph closing speed that doesn't provide nearly enough time for the force of the oncoming air to move the drone out of the way.

<comment><USER29> Thanks. But one question. What is the chance that a drone in the path of an airplane will not be impacted by the force of some other object on, or design of, the plane that is not the wing? For example the engine or the landing gear (small plane) or the fuselage? So we hover a drone in front of a small plane and will the small plane hit the drone? And if a larger jet will the drone remain in place or move out of the way by some force (not the wing).

And remenber that the drone has to exactly strike in a particular way.

As an example (of 'in a particular way') think of a nail on the road. The nail needs to be in exactly the right position to puncture a modern tire. That only happens in a very small amount of cases (or with a screw). Normally if it doesn't randomly happen the nail or screw gets pushed aside and does not puncture the tire. [1]

This is not a statement based on expertise I am just offering another point to consider and am curious.

[1] This I think is what happens with a paper cut sharp edge and precise angle.

<comment><USER30> At high closing speed, the determiner is whether the drone is in front of some part of the plane as the plane approaches. It's not going to be "pushed out of the way" because there just isn't time.

Think about moths hitting the windshield of your car. They weigh thousands of times less than your car, yet they still routinely splat on your windshield as you're going down the highway. Why? Why doesn't the air flowing around your car push them out of the way?

</comment></comment></comment></comment></comment><comment> cde-v I'm honestly surprised we haven't seen anyone try to take down a plane by flying a drone into an engine on takeoff.

<comment><USER31> I was discussing this with someone a few weeks ago, and swarms of drones (flying in formation) are a concern, and the only thing really stopping it is that no one has tried (as neuralRiot says).

Unfortunately, I don't really know how you would prevent it.

<comment><USER32> I'm sure it could be done, but I'm also willing to bet there are even easier ways to threaten airplanes that don't involve relatively new consumer products.

</comment></comment></comment><comment><USER33> We need to set about reinforcing the leading edges of airplane surfaces. :-)

</comment><comment><USER34> I wonder how easy it would be to make drones have a stronger radar signal? It's probably not nice to clutter up the displays of ATC, but it would be I think a more direct solution for controlled airspace

<comment><USER35> Radar reflectors are common on certain aircraft or even boats:

[https://www.gaelforcemarine.co.uk/en/GB/Trem-IOR-Radar- Refle...](https://www.gaelforcemarine.co.uk/en/GB/Trem-IOR-Radar- Reflector/m-3603.aspx?PartnerID=22&utm_source=google&utm_medium=shopping&utm_campaign=UnitedKingdom&gclid=EAIaIQobChMIw8Sn6fvq3QIVCpPtCh3ArgWNEAQYASABEgKoefD_BwE)

They used to equip some stealth aircraft during training with them so they could be more easily tracked.

<comment><USER36> Stealth aircraft deploy them whenever they're operating in civilian airspace so they can integrate into the existing radar-based ATC infrastructure.

They're called Luneburg Lenses: [https://en.m.wikipedia.org/wiki/Luneburg_lens](https://en.m.wikipedia.org/wiki/Luneburg_lens)

</comment></comment></comment><comment><USER37> This type of incident seems unlikely to happen by accident.

<comment><USER38> Against a commercial airliner you'd pretty much have to be flying right near the runway of the airport, but for a GA Cessna those can be flying pretty much anywhere.

I can easily see how a small plane could accidentally hit a drone.

<comment><USER37> If you're talking about the Cessna planes I think you're talking about, this test doesn't apply because those don't travel at 238 mph. Actually I think that speed is typically subject to altitude requirements that would exclude most drones?

But also we're talking about tiny objects traveling through a giant 3-D space. If they meet, it was on purpose.

<comment><USER39> 4D. Space + time. The odds of a collision are astronomically low outside of an airport's restricted zone. There are 1.5 billion cubic miles of atmosphere between the Earth and the maximum altitude of a commercial jet (7.8 miles).

<comment><USER40> In 4D the drone is not "travelling through", it's instead a static and _enormously_ long curve that has to avoid touching any other aircraft curve at any point.</comment></comment></comment></comment></comment>


Stop Relying on Your Resume - <AUTHOR> http://blog.zeltser.com/post/1648239403/stop-relying-on-your-resume <comment><USER2> This is a bit ranty/preachy, but I feel like many young people don't quite 'get it' as they get out of school and into the work world.

I don't know a single person who got a job through a resume or filling out an application (that usually happens AFTER the person is picked to be hired, to satisfy the HR drones).

Get out of the house/current office and meet people. Hang out at local user meetups, attend any conferences or talks you can afford to (and actually interact with people there). GIVE talks and hold teaching sessions on something you know a bit about - there always seems to be an incredible amount of desire for 'Subject X 101' type stuff.

The key is to meet new people in a meaningful way. Networking.

In addition to not knowing anybody who got a job based on resumes, I've also never hired anyone based on a resume. Much like the VC business for startup funding - if you can't figure out how to get an introduction via your personal network, you probably aren't ready for the interview.

Like it or not, PEOPLE drive business, both in and out of tech. There's no getting around it.

There's also no excuse for a fresh young college graduate to not have a tremendous network built up - it's one of the main things you should be getting from your huge amount of student debt. Leverage your professors, TAs, post-docs and even your friends and fellow students - they all know people who are hiring, or can introduce you to other groups of people that will know people.

As a last ditch effort - even a recruiter is better than just a cold email.

<comment><USER3> Thats one way, but honestly it is far from the best.

The only part where people matter is that they have to be more impressed by you than any other candidate - the best way to do so may be to smooze with them, but honestly you should only do that if you can't impress them by writing a useful program, or design an nice website.

<comment><USER2> I think you misunderstand - I don't mean 'smoozing' with people. I mean connecting with them in a real, meaningful fashion. Meeting people just to ask them for jobs is not real or meaningful.

E.g.: I got my last job when I mentioned at a group dinner that I was looking to move on - one of the other attendees said they had an opening doing interesting stuff. I'd known him for almost 4 years at that point, entirely because of the group dinners - never thought I'd get a job directly from him out of it.

When you go through a person in your personal network, you get a bunch of benefits - this applies equally to hiring and looking for a new job. If I hire someone because I or someone I trust knows them, I have a very high amount of confidence in them. If I pick someone up from Monster, then it's a complete crapshoot (in both ways - they may be way better than their resume, or way worse).

</comment></comment></comment><comment><USER4> _Self-publishing a mini e-book that shares your perspective with the world_

This would be a definite "minus" in my book in a potential employee, unless I was hiring an editorialist. Instead, I would want to see results and understanding of the business. I agree that a resume doesn't do that justice, but it helps when done correctly.

<comment><USER5> Care to elaborate?

<comment><USER4> Sure. If someone took the time to write a book about what s/he thinks, and I don't mean teaching some subject (including their experiences in the subject), or writing some other fiction other non-fiction, but rather some semi-informed garbage providing only their opinion ("What I Think About ...", "Everything I Believe", or "My Autobiography"), then s/he is a substantial amount of time on a throwaway work. This is different than responding with opinion on HN, etc. because it isn't a discussion where they might actually engage someone else; it is a one-way conversation. Now if they wrote a wise work of art and is marketed correctly or widely popular, I might reconsider, but that probably isn't the case. I don't want someone who wrote a book like that and flaunting it in conversation working for me, because unless they are applying to a position as an editorialist, I don't want to read their diatribe emails or listen to soliloquies about their feelings on various subjects while at work, I want them to get their work done.

Why is a resume that shows understanding of the business important? Because it shows that they are focused on what is important to the work and relaying that information, rather than their opinion.

</comment></comment></comment><comment><USER6> viz highly skilled wage slave.</comment>


Best of Vim tips - <AUTHOR> http://www.rayninfo.co.uk/vimtips.html

<comment><USER2>
       ### These Tips are now being maintained at zzapper.co.uk/vimtips.html

Probably best to use

<http://zzapper.co.uk/vimtips.html>

The blog at

<http://www.vimtips-blog.com/> has more</comment>


Marijuana exposure in utero has lifelong consequences in mice - <AUTHOR> http://arstechnica.com/science/2015/10/marijuana-exposure-in-utero-has-lifelong-consequences/ <comment><USER2> Shame on Ars for this clickbait trash- with "In mice at least, although humans might want to be cautious." as a subtitle it is hard to take the rest of the article seriously. Then you find out they were injecting mice with some unspecified amount of THC within Saline solution (please correct me if there is a specified amount, but I had to dig to find this at [http://www.pnas.org/content/suppl/2015/10/09/1514962112.DCSu...](http://www.pnas.org/content/suppl/2015/10/09/1514962112.DCSupplemental/pnas.201514962SI.pdf))

"THC (THC Pharm) was diluted in 0.9% NaCl (saline) solution containing 3% (vol/vol) DMSO and 2% (vol/vol) Tween-80 and administered intraperitoneally (i.p.) at a final dose of 3 mg/kg to pregnant females for 5 consecutive days, from E12.5 to E16.5. Control mice were injected with vehicle solution."

This will be on Fox news within a week, and when it is- they will monger fear in older generations (those who typically control laws by either voting or creating bills) that are too lazy to research and come to their own conclusions.

<comment><USER3> It looks like the paper says they were given 3mg/kg THC per day for 5 consecutive days. So it does seem the dose is specified.

It's pre clinical and far from surprising but 3mg/kg is a lot of THC, the equivalent of using ~1g of strong stuff by yourself (assuming no THC is lost during consumption).

<comment><USER2> After looking up the potency of currently popular edibles, the highest dosage I could find per item was the Cheeba Chew Deca Dose([http://www.cheebachews.com/wp- content/uploads/2015/02/deca_1...](http://www.cheebachews.com/wp- content/uploads/2015/02/deca_15.pdf)) @ claimed 175mg of THC per piece (actual was 162.1). As far as I know, this is a heroic dose of THC of which the typical user would not frequent. In order to match the dosage within the mice, I'd have to eat just over 6 of these per days for a working week to produce the same results (obviously without comparing intake medium).

I understand this was to attempt to see if there were any issues that should be researched further, but the Ars article took it at face value and claimed we should (as humans) avoid during pregnancy.

</comment></comment></comment><comment><USER4> I don't see why they didn't just have them consume food with oil in it, this seems like a highly unnatural delivery mechanism.

Relevant comment from Ars:

> Interesting to note... If you look at the study

> "THC (THC Pharm) was diluted in 0.9% NaCl (saline) solution containing 3% > (vol/vol) DMSO and 2% (vol/vol) Tween-80 and administered intraperitoneally > (i.p.) at a final dose of 3 mg/kg to pregnant females for 5 consecutive > days, from E12.5 to E16.5. Control mice were injected with vehicle > solution."

> DMSO is TOXIC to developing brains. Its actually recommended not to use it > in studies because it causes too much damage.

> "The in vitro results suggest avoiding the use of BeOH (which also is more > toxic than the other solvents in the in vivo test) and DMSO and using > PEG400, EtOH and DMF even though the latter induced a body weight decrease > in the B6D2F1 mouse strain. "

> > [http://www.ncbi.nlm.nih.gov/pubmed/8011014](http://www.ncbi.nlm.nih.gov/pubmed/8011014)

> It would seem as though they purposefully paired the THC with a solvent that > would cause the relevant brain abnormalities.

</comment><comment><USER5> "So, like alcohol, another recreational drug that is legal in the US, marijuana is likely best avoided by pregnant women."

This is so refreshing to see articles made with a neutral tone about marijuana and not the usual "IT'S EVIL" talk. It's a recreational drug like any other. You wouldn't drink when pregnant, you shouldn't smoke either. Those fact shouldn't be related at all about whether the substance is legal or not.

<comment><USER6> Why shouldn't women have some alcohol when pregnant? Where's the evidence that small amounts of alcohol are harmful?

The total ban on alcohol during pregnancy is based on the precautionary principle - we know alcohol is harmful, but we don't know what a safe limit is, so we set a limit of zero.

This causes guilt and stress in mothers, and that is probably more harmful than letting pregnant women have a small glass of wine every so often.

<comment><USER7> > Where's the evidence that small amounts of alcohol are harmful?

>we know alcohol is harmful, but we don't know what a safe limit is, so we set a limit of zero.

Literally that right there. It's not like we can test on humans to find what the safe amount is, that's highly unethical, highly illegal, and will never be done. The safe amount is zero, or as close to zero as you can get. It shouldn't cause any guilt or stress on the mother: it's not impossible or even difficult to completely abstain from alcohol for nine months unless you're an alcoholic, and if you're an alcoholic, you're not going to have "a small glass of wine every so often". There's actually _negative_ societal pressure for pregnant women drinking.

What would cause more stress and guilt? Not drinking while pregnant, or drinking some amount and then wondering if your child will be born with some birth defect because of it? Or wondering if your child's birth defect was caused by your drinking? The safe bet is just to not drink, to not smoke, to not abuse drugs.

I honestly never thought I would be seeing a discussion about how it's not fair to ask pregnant women to abstain from alcohol.

<comment><USER6> > What would cause more stress and guilt? Not drinking while pregnant, or > drinking some amount and then wondering if your child will be born with some > birth defect because of it? Or wondering if your child's birth defect was > caused by your drinking? The safe bet is just to not drink, to not smoke, to > not abuse drugs.

Just for clarity: I mean a small glass per week. I said "a small glass every so often".

There's zero chance of a birth defect from one small glass of wine a week. But women doing that will, as you say, face fierce societal condemnation whenever they drink.

> I honestly never thought I would be seeing a discussion about how it's not > fair to ask pregnant women to abstain from alcohol.

It's not about whether it's fair or not. It's about whether the risks from small amounts of alcohol are greater than the risks of stress and anxiety women experience when guilt-tripped by other people.

Society has some really unpleasant judgemental attitudes about pregnant women. They're already under a load of self-imposed pressure. They don't need it from other people.

<comment><USER7> >There's zero chance of a birth defect from one small glass of wine a week.

Where's the evidence to back this up?

Here are the facts:

1\. Alcohol is harmful.

2\. We don't know exactly how harmful.

3\. We can't test to see exactly how harmful.

The output of that is, the recommendation is zero. The recommendation is zero because any other recommendation would be arbitrary at best, harmful on average, and debilitating at worst when people realize "one drink a week" isn't backed up by any science. And the social pressure will never let up, because who knows if that is the woman's first drink of the week or her fourth drink of the day?

Yes of course people need pressure to not drink while pregnant! And even with that pressure, people still smoke and drink and do drugs while pregnant. Just like they need pressure not to speed, not to shoot up heroin, not to kill other people! That's the entire point of societal pressure, is to make people conform to activities that aren't actively harmful to society.

If you tell women "don't drink", that's a very clear statement. Easy to follow. If you say "only drink one drink per week, maybe, we don't really know", there's a non-zero chance that more women will drink more than they should than we have today. But how much is too much? No one knows. So in effect, how much is too much? _Any_ amount.

<comment><USER8> I replaced "alcohol" with "sex", and "drink" with "lay", and it worked out remarkably well, with appropriately humorous results.

I invite the reader to do the same.

<comment><USER7> Now try replacing "alcohol" with "a bullet through the head" and see if it's still funny. Or try doing a Google image search of "fetal alcohol syndrome". Smart asshole.

<comment><USER8> Please don't do this on HN. personal attacks are not welcomed on this website.

<comment><USER7> Calling someone an asshole is not a personal attack. A personal attack is attacking someone's character instead of their argument. I'm not saying he's wrong because he's an asshole, I'm saying he's wrong _and_ he's an asshole.

<comment><USER9> In my view - which I expect is shared by at least some others - saying that another poster is an asshole is a personal attack whether or not it has anything to do with their argument.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I'd highly recommend listening to this experiment on how this truly works when considering epigentics:

[https://youtu.be/9DAcJSAM_BA?t=1764](https://youtu.be/9DAcJSAM_BA?t=1764)

<comment><USER2> Fantastic suggestion- I enjoyed this immensely. Thank you.

<comment><USER10> Your welcome. The whole field of epigentics is turning everything we know about biology on its side. It's amazing.</comment></comment></comment>


Ask HN: Tech Start-up for people with families? - <AUTHOR>

Are there instances of people who have families to feed and have successfully started Tech start-ups in US? This is especially important in US because the cost of living is high. What is the thought process of the people who make the decisions that involve huge financial risks, not only for them, but more so for their kids and spouse.
If there are any success stories then they would be immensely inspirational to a lot of people out there.
Thoughts? <comment><USER2> > _This is especially important in US because the cost of living is high_

Cost of living in the US expensive? Have you traveled to Europe or Japan? _Life is way more expensive in Europe_ , and in some European countries salaries are way lower than in the US.

It's __raising kids __what is more expensive in the US than in Europe:

* 'Why Middle Class Mothers and Fathers Are Going Broke' <http://www.msnbc.msn.com/id/3079221/>

* The Coming Collapse of the Middle Class <http://www.youtube.com/watch?v=akVL7QY0S8A>

* The Two-income Trap By Elizabeth Warren, Amelia Warren Tyagi [http://books.google.com/books?hl=en&id=_IFTf-_9fSsC&...](http://books.google.com/books?hl=en&id=_IFTf-_9fSsC&dq=two-income+trap&printsec=frontcover&source=web&ots=ssAIIrsz4K&sig=UuaimBU4LAu3bAbTI5pZQpPCTzQ&sa=X&oi=book_result&resnum=3&ct=result)

 _Solution_ : Move to Europe. I did the opposite. I moved from Europe to the US, but that's because I don't have kids.

</comment><comment><USER3> This guy: <http://mortenlund.wordpress.com/> is a crazy serial entrepreneur that has started around 40 companies. He was an early investor in Skype, started antivirus company Bullguard, etc. He has a wife and four kids...

He is in Denmark, but according to the Economist Copenhagen is more expensive than both New York and SF.

</comment><comment><USER4> Here's a thread to get you started:

<http://news.ycombinator.com/item?id=288901></comment>